AI agents become much harder to secure once they can execute generated code, call external tools, or interact with services you don't fully trust.
In this session, we'll take one deliberately unsafe AI agent and harden it step by step using the latest Azure Container Apps capabilities. We'll isolate untrusted code execution with Azure Container Apps Sandboxes, explore where Container Apps Express fits for lightweight and fast-starting agent workloads, and add runtime policy enforcement with Microsoft's open-source Agent Governance Toolkit.
Rather than treating these as separate product features, we'll use them on the same agent and see what each layer actually protects. We'll execute code inside a microVM-isolated sandbox, experiment with moving parts of the agent architecture to Express, and enforce policies that allow or block tool calls at runtime.
By the end of the session, you'll understand the difference between sandboxing, infrastructure isolation, identity, and runtime governance, where each capability fits in an agent architecture, and which security problems they solve—and which ones they don't.
If you're building AI agents that can do more than answer questions, this session will show you how to move from a powerful prototype to an architecture you can trust in production.